News for hackers. Stuff that matters.

A comment on ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkthrough. Parent comment

Re:ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkth... by dastbe on Sunday November 21, 2021 @01:15PM (#29298342)
not the op but aws made the same determination. the tl;dr is that the surface area of containerization leads to an unacceptable risk of privilege escalation.
[ Parent | on HN ]
Re:ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkth... by someuname on Sunday November 21, 2021 @01:30PM (#29298486)
That explains what, but not why
[ Parent | on HN ]
Re:ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkth... by native_samples on Monday November 22, 2021 @08:15AM (#29305982)
Containers were never actually designed to be sandboxes, and inside you have access to many system calls and a comparatively huge surface area inside the kernel and userland, all written in C, with a long history of local root exploits due to C based bugs.
[ Parent | on HN ]
Re:ChaosDB Explained: Azure's Cosmos DB Vulnerability Walkth... by withinboredom on Monday November 22, 2021 @06:20AM (#29305204)
Because if you can get root in a container, you have root outside the container. While escaping a container isn’t exactly easy or always possible, it is a huge risk.
[ Parent | on HN ]